Watermark Information Embedding Method and Apparatus

ABSTRACT

A method and an apparatus for embedding watermark information are disclosed in the present disclosure. The method trains an embedded neural network model using weight information of a target neural network model and target watermark information that is to be embedded into the target neural network model, updates the weight information of the target neural network model according to target watermark embedded data provided by the embedded neural network model, and obtains a target neural network model embedded with the target watermark information. Since the embedded neural network model includes multiple neural network layers, this method increases the complexity of the watermark embedding process, and is able to avoid the problem that watermark information of existing neural network models has poor robustness to watermarking attacks such as overwriting attacks and model compression.

CROSS REFERENCE TO RELATED PATENT APPLICATIONS

This application claims priority to and is a continuation of PCT PatentApplication No. PCT/CN2020/123888 filed on 27 Oct. 2020, and is relatedto and claims priority to to Chinese Application No. 201911036839.X,filed on 29 Oct. 2019 and entitled “Watermark Information EmbeddingMethod and Apparatus,” which are hereby incorporated by reference intheir entirety.

TECHNICAL FIELD

The present disclosure relates to the field of computer technology, andin particular, to watermark information embedding methods. The presentdisclosure also relates to watermark information embedding apparatusesand electronic devices. The present disclosure further relates towatermark information hiding apparatuses and electronic devices. Thepresent disclosure further relates to watermark information extractionmethods, apparatuses and electronic devices. The present disclosure alsorelates to watermark information embedding systems.

BACKGROUND

Neural network models can be applied to a number of fields, such asspeech recognition, natural language processing (NLP), computer vision(CV), big data mining, etc., and can run on a number of carriers, suchas computer central processing units (CPU), graphics accelerators (GPU),tensor processors (TPUs), dedicated artificial intelligence chips, cloudcomputing centers, mobile devices, wearable devices, smart videoterminals, in-vehicle devices and other vehicles, Internet of Thingsdevices, etc.

Development costs for neural network include hardware costs such ascentral processing units (CPUs), graphics processing units (GPUs), etc.,software costs such as operating systems, supporting software, and deeplearning algorithms, etc., and learning and training costs such asenergy and time consumption of data acquisition, data labeling, anddevelopment, debugging and operation of learning and trainingalgorithms, etc.

Due to the relatively high development costs as described above, whilesharing and promoting a trained neural network model, it is alsonecessary to protect the intellectual property rights of the neuralnetwork model, and embedding watermark information for the neuralnetwork model is one of the most effective ways of protection of theproperty rights.

However, existing neural network watermark embedding algorithms mainlyhave the following two problems: 1. a weight distribution of an originalneural network model is changed after watermark information is embeddedin the neural network model, which makes the watermark information inthe neural network model easier to be detected; and 2. the embeddedwatermark information is less robust to watermark attacks such asoverwriting attacks and model compression, etc.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify all key featuresor essential features of the claimed subject matter, nor is it intendedto be used alone as an aid in determining the scope of the claimedsubject matter. The term “techniques,” for instance, may refer todevice(s), system(s), method(s) and/orprocessor-readable/computer-readable instructions as permitted by thecontext above and throughout the present disclosure.

Embodiments of the present disclosure provide a watermark informationembedding method and a watermark information hiding method, so as tosolve the problems that watermark information in an existing neuralnetwork model is easier to be detected, and embedded watermarkinformation is less robust to watermark attacks such as overwritingattacks and model compression, etc. The problem of weak robustness ofattack means. Other embodiments of the present disclosure also provide awatermark information embedding apparatus and an electronic device.Other embodiments of the present disclosure also provide a watermarkinformation hiding apparatus and an electronic device. Other embodimentsof the present disclosure further provide a watermark informationextraction method, a watermark information extraction apparatus, and anelectronic device. Other embodiments of the present disclosure alsoprovide a watermark information embedding system.

Embodiments of the present disclosure provide a method for embeddingwatermark information, which includes: obtaining weight information of atarget neural network model; obtaining target watermark information; andusing the target watermark information and the weight information of thetarget neural network model to train an embedded neural network model,and updating the weight information of the target neural network modelaccording to target watermark embedded data provided by the embeddedneural network model to obtain the target neural network model embeddedwith the target watermark information, wherein the embedded neuralnetwork model is used for obtaining the target watermark embedded dataaccording to the weight information of the target neural network model,and the target watermark embedded data is used for representing anembedding degree of embedded watermark information in the target neuralnetwork model.

In embodiments, using the target watermark information and the weightinformation of the target neural network model to train the embeddedneural network model includes: obtaining weight information of apre-trained reference neural network model without the watermarkinformation embedded, the reference neural network model and the targetneural network having a same structure; obtaining random noiseinformation, the random noise information and the target watermarkinformation having a same structure; and training the embedded neuralnetwork model according to the weight information of the referenceneural network model, the random noise information, the weightinformation of the target neural network model and the target watermarkinformation.

In embodiments, training the embedded neural network model according tothe weight information of the reference neural network model, the randomnoise information, the weight information of the target neural networkmodel, and the target watermark information includes: using the weightinformation of the target neural network model as an instance of a firstwatermark training set, using the target watermark information as alabel of the first watermark training set, and using the weightinformation of the reference neural network model as an instance of asecond watermark training set, and using the random noise information asa label of the second watermark training set; and using the firstwatermark training set and the second watermark training set as atraining set, updating the weight information of the embedded neuralnetwork model according to a model loss function of the embedded neuralnetwork model until the model loss function converges.

In embodiments, while training the target neural network model, updatingthe weight information of the target neural network model according tothe target watermark embedded data provided by the embedded neuralnetwork model to obtain the target neural network model embedded withthe target watermark information includes: inputting first weightinformation of the target neural network model into the embedded neuralnetwork model; obtaining first target watermark embedded data outputtedby the embedded neural network model, the target watermark embedded dataincluding watermark information extracted from the first weightinformation of the target neural network model by the embedded neuralnetwork model; terminating the training of the embedded neural networkmodel if the first target watermark embedded data indicates that thetarget watermark information has been embedded in the first weightinformation, and determining that a target neural network modelcorresponding to the first weight information as the target neuralnetwork model embedded with the target watermark information; trainingthe embedded neural network model if the first target watermark embeddeddata indicates that the target watermark information is not completelyembedded in the first weight information to obtain an embedded neuralnetwork model that has completed a first training, and providing thefirst target watermark embedded data to the target neural network model;updating the weight information of the target neural network modelaccording to the first target watermark embedded data to obtain secondweight information of the target neural network model; inputting thesecond weight information of the target neural network model to theembedded neural network model that completes the first training; and byanalogy, until the target neural network model that is completelyembedded with the target watermark information and the target watermarkinformation of the embedded neural network model that is able to beextracted from the weight information of the target neural network modelare obtained.

In embodiments, training the embedded neural network model to obtain theembedded neural network model that has completed the first training ifthe first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the target neuralnetwork model, includes: using the first weight information of thetarget neural network model and the target watermark information as awatermark training set, updating the weight information of the embeddedneural network model according to the watermark training set to obtainthe embedded neural network model that completes the first training.

In embodiments, training the embedded neural network model to obtain theembedded neural network model that has completed the first training ifthe first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the target neuralnetwork model, includes: obtaining random noise information, the randomnoise information having a same structure as the target watermarkinformation; obtaining first weight information of a reference neuralnetwork model, the reference neural network and the target neuralnetwork having a same structure, and the random noise information beingnot completely embedded in the first weight information of the referenceneural network model; and using the first weight information of thereference neural network model, the random noise information, the firstweight information of the target neural network model, and the targetwatermark information as a watermark training set, and updating theweight information of the embedded neural network model according to thewatermark training set to obtain the embedded neural network model thatcompletes the first training.

In embodiments, updating the weight information of the target neuralnetwork model according to the target watermark embedded data providedby the embedded neural network model to obtain the target neural networkmodel embedded with the target watermark information includes: obtaininga regular term for embedding the watermark information according to thetarget watermark embedded data; adding the regular term for embeddingthe watermark information on a basis of a corresponding model lossfunction when training the target neural network model using aconventional training set; and updating the weight information of thetarget neural network based on the model loss function and the regularterm for embedding the watermark information, and obtaining the targetneural network model embedded with the target watermark information.

Embodiments of the present disclosure also provide a watermarkinformation hiding method, which includes: obtaining reference weightinformation of a reference neural network model that is not embeddedwith watermark information; obtaining target weight information of atarget neural network model that is embedded with partial watermarkinformation, the reference neural network model and the target neuralnetwork model having a same structure; and using the reference weightinformation and the target weight information as a training set to traina detection neural network model, and adjusting a model training methodof the target neural network model according to distinguishability dataof the reference weight information and the target weight informationoutputted by the detection neural network model, and obtaining a targetneural network model that satisfies a watermark information hidingcondition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model, and adjusting the model training method of the targetneural network model according to the distinguishability data of thereference weight information and the target weight information outputtedby the detection neural network model to obtain the target neuralnetwork model that satisfies the watermark information hiding condition,include: using the reference weight information and the first targetweight information as the training set to train the detection neuralnetwork model; obtaining first distinguishability data of the referenceweight information and the first target weight information outputted bythe detection neural network model; determining a target neural networkmodel corresponding to the first distinguishability data as the targetneural network model that satisfies the watermark information hidingcondition if the first distinguishability data indicates that thereference weight information and first target weight information isindistinguishable; providing the first distinguishability data to thetarget neural network model to allow the target neural network model toupdate the weight information according to the first distinguishabilitydata and obtain second target weight information if the firstdistinguishability data indicates that the reference weight informationis distinguishable from the first target weight information; using thereference weight information and the second target weight information asa training set to train the detection neural network model; and soforth, until target distinguishability data satisfying a presetwatermark information hiding condition is obtained, and a target neuralnetwork model corresponding to the target distinguishability data isdetermined as the target neural network model that satisfies thewatermark information hiding condition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes: sorting the reference weight information, andadding label information that is not embedded with watermark informationto the sorted reference weight information; sorting the target weightinformation, and add label information that is embedded with watermarkinformation to the sorted target weight information; using the sortedreference weight information and the label information thereof as afirst training sample, using the sorted target weight information andthe label information thereof as a second training sample, training thedetection neural network model according to the first training sampleand the second training sample, to cause the detection neural networkmodel to be able to distinguish between the reference weight informationand the target weight information.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes using the reference weight information and thetarget weight information as the training set, and updating the weightinformation of the detection neural network model according to a modelloss function of the detection neural network model.

In embodiments, adjusting the model training method of the target neuralnetwork model according to the distinguishability data of the referenceweight information and the target weight information outputted by thedetection neural network model includes: obtaining a regular term usedfor hiding the watermark information according to the distinguishabilityinformation; adding the regular term used for hiding the watermarkinformation on a basis of a corresponding model loss function when usinga conventional training set to train the target neural network model anda regular term used for embedding the watermark information, andobtaining a target loss function corresponding to the target neuralnetwork model; and updating the weight information of the target neuralnetwork model based on the target loss function.

Embodiments of the present disclosure also provide a method forextracting watermark information, which includes: obtaining a targetneural network model; obtaining target weight information of the targetneural network model; inputting the target weight information into anembedded neural network model to obtain target watermark informationoutputted by the embedded neural network model, the embedded neuralnetwork model being obtained by training according to weight informationof the target neural network model when the watermark information isembedded and original watermark information embedded in the targetneural network model, and the embedded neural network model being usedfor obtaining the watermark information embedded in the target neuralnetwork model according to the weight information of the target neuralnetwork model; and matching the target watermark information with theoriginal watermark information embedded in the target neural networkmodel, and determining whether the target watermark information is thewatermark information embedded in the target neural network model.

Embodiments of the present disclosure also provide an apparatus forembedding watermark information, which includes: a weight informationacquisition unit used for obtaining weight information of a targetneural network model; a target watermark information acquisition unitused for obtaining target watermark information; an embedded neuralnetwork model training unit used for using the target watermarkinformation and the weight information of the target neural networkmodel to train an embedded neural network model, the embedded neuralnetwork model being used for obtaining embedding degree information ofwatermark information embedded in the target neural network modelaccording to the weight information of the target neural network model;and a target neural network model acquisition unit used for updating theweight information of the target neural network model according to theembedding degree information provided by the embedded neural networkmodel, and obtaining a target neural network model embedded with thetarget watermark information.

Embodiments of the present disclosure further provide an electronicdevice, which includes: a processor and a memory, the memory being usedfor storing a watermark information embedding program, and the program,when being read and executed by the processor, performing the followingoperations: obtaining weight information of a target neural networkmodel; obtaining target watermark information; using the targetwatermark information and the weight information of the target neuralnetwork model to train an embedded neural network model, the embeddedneural network model being used for obtaining target watermark embeddeddata according to the weight information of the target neural networkmodel, and the target watermark embedded data being used forrepresenting an embedding degree of embedded watermark information inthe target neural network model; and updating the weight information ofthe target neural network model according to the target watermarkembedded data provided by the embedded neural network model, andobtaining a target neural network model embedded with the targetwatermark information.

Embodiments of the present disclosure further provide a watermarkinformation hiding apparatus, which includes: a reference weightinformation acquisition unit used for obtaining reference weightinformation of a reference neural network model that is not embeddedwith watermark information; a target weight information acquisition unitused for obtaining target weight information of a target neural networkmodel that is embedded with partial watermark information, the referenceneural network model and the target neural network model having a samestructure; and a target neural network model acquisition unit used forusing the reference weight information and the target weight informationas a training set to train a detection neural network model, andadjusting a model training method of the target neural network modelaccording to distinguishability data of the reference weight informationand the target weight information outputted by the detection neuralnetwork model, and obtaining a target neural network model thatsatisfies a watermark information hiding condition.

Embodiments of the present disclosure also provide an electronic device,including: a processor and a memory, the memory being used for storing awatermark information hiding program, and the program when being readand executed by the processor, performing the following operations:obtaining reference weight information of a reference neural networkmodel that is not embedded with watermark information; obtaining targetweight information of a target neural network model that is embeddedwith partial watermark information, the reference neural network modeland the target neural network model having a same structure; and usingthe reference weight information and the target weight information as atraining set to train a detection neural network model, and adjusting amodel training method of the target neural network model according todistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel, and obtaining a target neural network model that satisfies awatermark information hiding condition.

Embodiments of the present disclosure further provide an apparatus forextracting watermark information, which includes: a target neuralnetwork model acquisition unit used for obtaining a target neuralnetwork model; a target weight information acquisition unit used forobtaining target weight information of the target neural network model;a target watermark information acquisition unit used for inputting thetarget weight information into an embedded neural network model toobtain target watermark information outputted by the embedded neuralnetwork model, the embedded neural network model being obtained bytraining according to weight information of the target neural networkmodel when the watermark information is embedded and original watermarkinformation embedded in the target neural network model, and theembedded neural network model being used for obtaining the watermarkinformation embedded in the target neural network model according to theweight information of the target neural network model; and a watermarkinformation matching unit used for matching the target watermarkinformation with the original watermark information embedded in thetarget neural network model, and determining whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

Embodiments of the present disclosure also provide an electronic device,including: a processor and a memory, the memory being used for storing awatermark information extraction program for a neural network, and theprogram, when being read and executed by the processor, performing thefollowing operations: obtaining a target neural network model; obtainingtarget weight information of the target neural network model; inputtingthe target weight information into an embedded neural network model toobtain target watermark information outputted by the embedded neuralnetwork model, the embedded neural network model being obtained bytraining according to weight information of the target neural networkmodel when the watermark information is embedded and original watermarkinformation embedded in the target neural network model; the embeddedneural network model being used for obtaining the watermark informationembedded in the target neural network model according to the weightinformation of the target neural network model; and matching the targetwatermark information with the original watermark information embeddedin the target neural network model, and determining whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

The present disclosure also provides a watermark information embeddingsystem, which includes:

a data acquisition module, a watermark information embedding module, awatermark information hiding module, and a target neural network modelupdating module;

the data acquisition module being used for obtaining original weightinformation of a target neural network model; obtaining target watermarkinformation; obtaining reference weight information of a referenceneural network model; obtaining random noise data; providing thereference weight information and the noise data to the watermarkinformation embedding module; and providing the reference weightinformation to the watermark information hiding module, the targetneural network model and the reference neural network model having thesame network structure;

the watermark information embedding module being used for training anembedded neural network model using the target watermark information,the original weight information, the reference weight information andthe noise data as an embedded watermark training set, and obtaining thetarget watermark embedded data outputted by the embedded neural networkmodel, the target watermark embedded data being used to represent anembedding degree of embedded watermark information in the target neuralnetwork model; and providing the target watermark embedded data to theneural network model updating module;

the watermark information hiding module being used for training adetection neural network model using the weight information embeddedwith watermark information and the reference weight information providedby the neural network model updating module as a hidden watermarktraining set, and obtaining distinguishability data of the weightinformation embedded with the watermark information and the referenceweight information outputted by the detection neural network model; andproviding the distinguishability data to the neural network modelupdating module; and the neural network model updating module being usedfor updating the weight information of the target neural network modelin a manner that enables the target neural network model to achievepredetermined functions thereof, updating the weight information of thetarget neural network model on a basis thereof according to targetwatermark embedded data provided by the watermark information embeddingmodule, and obtaining the weight information embedded with the watermarkinformation; providing the weight information embedded with thewatermark information to the watermark information hiding module; andupdating the weight information of the target neural network modelaccording to the distinguishability data provided by the watermarkinformation hiding module, and obtaining a target neural network modelembedded with the target watermark information and satisfying awatermark information hiding condition.

Compared with existing technologies, the present disclosure has thefollowing advantages:

The watermark information embedding method for neural networks providedby the present disclosure trains an embedded neural network modelthrough weight information of a target neural network model and targetwatermark information to be embedded in the target neural network model,updates the weight information of the target neural network modelaccording to target watermark embedded data provided by the embeddingneural network model, and obtain a target neural network model embeddedwith the target watermark information. Since an embedded neural networkincludes multiple neural network layers, this method increases thecomplexity of a watermark embedding process and can avoid the problemthat watermark information of existing neural network models has poorrobustness to watermarking attacks such as overwriting attacks and modelcompression.

Furthermore, the watermark information hiding method for neural networksprovided by the present disclosure trains a detection neural networkmodel through reference weight information of a reference neural networkmodel that is not embedded with watermark information and target weightinformation of a target neural network model that is undergoing aprocess of embedding the watermark information. According todistinguishability data between the reference weight information and thetarget weight information outputted by the detection neural networkmodel, a model training method of a target neural network is adjusted toobtain a target neural network model that satisfies watermarkinformation hiding conditions. This method is based on ideas ofadversarial training of neural networks, which enhances the concealmentof watermark information in a target neural network model, and avoidsthe problem that watermark information is easier to be detected afterthe watermark information is embedded in an existing neural networkmodel.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart of a method for embedding watermark informationprovided by a first embodiment of the present disclosure.

FIG. 1-A is a schematic diagram of watermark information embedded in atarget neural network model provided by the first embodiment of theapplication.

FIG. 1-B is a schematic diagram of original watermark information to beembedded in a deep neural network model provided by the first embodimentof the present disclosure.

FIG. 1-C is a schematic diagram of watermark information extracted fromweight information of a deep neural network model provided by the firstembodiment of the present disclosure.

FIG. 2 is a flowchart of a method for hiding watermark informationprovided by a second embodiment of the present disclosure.

FIG. 2-A is a schematic diagram of watermark information embedded in ahidden target neural network model provided by the second embodiment ofthe present disclosure.

FIG. 3 is a flowchart of a method for extracting watermark informationprovided by a third embodiment of the present disclosure.

FIG. 4 is a schematic diagram of a watermark information embeddingsystem provided by a fourth embodiment of the present disclosure.

FIG. 5 is a unit block diagram of a watermark information embeddingapparatus provided by a fifth embodiment of the present disclosure.

FIG. 6 is a schematic diagram of a logical structure of an electronicdevice provided by a sixth embodiment of the present disclosure.

FIG. 7 is a unit block diagram of a watermark information hidingapparatus provided by a seventh embodiment of the present disclosure.

FIG. 8 is a schematic diagram of a logical structure of an electronicdevice provided by an eighth embodiment of the present disclosure.

FIG. 9 is a unit block diagram of a watermark information extractionapparatus provided by the ninth embodiment of the present disclosure.

FIG. 10 is a schematic diagram of a logical structure of an electronicdevice provided in a tenth embodiment of the present disclosure.

DETAILED DESCRIPTION

In the following description, numerous specific details are set forth inorder to provide a thorough understanding of the present disclosure.However, the present disclosure can be implemented in many other waysthat are different from those described herein. One skilled in the artcan make similar promotions without departing from the connotation ofthe present disclosure. Therefore, the present disclosure is not limitedby specific implementations disclosed below.

A typical existing watermark embedding algorithm for neural networkmodels is: adding a special regular term in a training process to embedwatermark information into weight information. Such solution can make aprocess of embedding watermark information and a process of training aneural network model to be carried out at the same time, so that theembedded watermark information does not affect the performance of theneural network model. However, in this method, an embedding matrix isresponsible for mapping weight information of a neural network model totarget watermark information. Specifically, a simple lineartransformation is performed on the weight information of the neuralnetwork model through a target embedding matrix. If the weightinformation is regarded as the input, the process of linear mapping isthe same as the process of passing weight information through asingle-layer neural network. In this case, other entities can generatean embedding matrix of the same dimension simply and randomly, and embedother watermark information in the neural network model. Due to thesimplicity of linear mapping, the generated embedding matrix of the samedimension is higher similar to the target embedding matrix, so thatother embedded watermark information can cover and delete the targetwatermark information. Therefore, this type of watermark embeddingalgorithm will leave traces in the statistical distribution informationof the weights of the neural network model, which makes the process ofdetecting the watermark information extremely easy, failing to meet theconcealment requirements of digital watermarks, and having relativelypoor robustness to watermark attacks such as overwriting attacks andmodel compression, etc.

For a watermark information embedding scenario of a neural networkmodel, in order to improve the robustness of the embedded watermarkinformation to watermark attack methods such as overwriting attacks andmodel compression, etc., and to enhance the concealment of the watermarkinformation embedded in the neural network model, the present disclosureprovides a watermark information embedding method, and a watermarkinformation embedding apparatus and an electronic device correspondingto the method, a watermark information hiding method, and a watermarkinformation hiding apparatus and an electronic device corresponding tosuch method. The present disclosure also provides a watermarkinformation extraction method, and a watermark information extractionapparatus and an electronic device corresponding to the method. Thepresent disclosure additionally provides a watermark informationembedding system. Embodiments are provided below to describe themethods, apparatuses, electronic devices and systems in detail.

The first embodiment of the present disclosure provides a method forembedding watermark information. An application entity of this methodcan be an application of a computing device used for embedding watermarkinformation into a neural network model. FIG. 1 is a method 100 forembedding watermark information provided by the first embodiment of thepresent disclosure. FIG. 1-A is a schematic diagram of embeddingwatermark information in a target neural network model provided by thefirst embodiment of the application. The method provided by thisembodiment is described in detail below with reference to FIG. 1 andFIG. 1-A. Embodiments involved in the following description are used toillustrate the principles of the method, and not to limit the practicaluses thereof.

As shown in FIG. 1, the method 100 for embedding watermark informationprovided by this embodiment includes the following steps:

S101: Obtain weight information of a target neural network model.

A neural network model learns and masters the data processing capabilityfor input signals through multi-layer feature extraction and byadjusting and optimizing neural network parameters. The input signalscan be digital signal samples of multimedia information such as voice,image, video, etc. The digital signal samples and the network structuredetermine the type of the data processing capability of the neuralnetwork, and the parameters of the neural network determine the pros andcons of the data processing capability. Neural networks include variousforms of network structures, such as a convolutional neural network(CNN), a recurrent neural network (RNN), a generative adversarialnetwork (GAN), etc. A digital convolution operation is the coreoperation of various types of neural network models. It calculates, in asliding window, the weighted weight value of an input digital signalaccording to parameters of a convolution kernel of the network, which isused as the input to the next layer. Different parameters determinedifferent weighted weight values. In a convolution layer of the neuralnetwork, a smaller-sized convolution kernel is used to cover the entiredimensional space of the input digital signal in a sliding manner, andin the fully connected layer, a full-sized convolution kernel is used tocalculate the weighted weight value of the input digital signal.

The target neural network model (the neural network model to be embeddedin FIG. 1-A, and the target neural network is used to represent suchmodel in the following test) refers to the neural network model to beembedded with the watermark information, and the weight information ofthe target neural network model refers to the statistical distributioninformation of weight values in the neural network model to be embeddedwith the watermark information.

S102: Obtain target watermark information.

The target watermark information refers to the watermark information tobe embedded in the above target neural network model, which may be apredetermined bit value or predetermined image information.

S103: Use the target watermark information and the weight information ofthe target neural network model to train an embedded neural networkmodel, and update the weight information of the target neural networkmodel according to target watermark embedded data provided by theembedded neural network model to obtain a target neural network modelembedded with the target watermark information.

After the weight information of the target neural network model and thetarget watermark information to be embedded in the target neural networkmodel are obtained in the above steps, this step is used to train theembedded neural network model (Embedder, a training neural network modelin FIG. 1-A, which can be used to assist the target neural network modelto embed the target watermark information, and the embedded neuralnetwork model is used to represent such model hereinafter) according tothe weight information and target watermark information. The weightinformation of the target neural network model is updated based on thetarget watermark embedded data provided by the embedded neural networkmodel, and the target neural network model embedded with the targetwatermark information is obtained.

The embedded neural network model is a neural network model includingmultiple neural network layers. After training, the embedded neuralnetwork model can be used to output target watermark embedded dataaccording to the weight information of the target neural network modelthat is inputted. The target watermark embedded data is used torepresent an embedding degree of the watermark information embedded inthe target neural network model. In this embodiment, the targetwatermark embedded data includes the watermark information that hasalready been embedded in the target neural network model.

In this embodiment, while training the target neural network model, theembedded neural network model is trained. A purpose thereof is to enablethe embedded neural network model to map the weight information of thetarget neural network model to the target watermark information to beembedded. Specifically, the embedded neural network model is trainedaccording to the target watermark information and the weight informationof the target neural network model, and the weight information of theembedded neural network model is updated according to a model lossfunction.

In this embodiment, the process of obtaining the target neural networkmodel embedded with the target watermark information is synchronizedwith the training process of the embedded neural network model, that is,the processes of training the target neural network model, training theembedded neural network model, and obtaining the target neural networkembedded with the target watermark information are all performedsynchronously. Before training the embedded neural network model andtraining the target neural network, it is necessary to obtain referenceweight information and random noise information of a reference neuralnetwork model. The reference neural network model has the same structureas that of the target neural network model, and the random noiseinformation and the target watermark information has the same structure.For example, the target watermark information is a 20-bit bit value, andthe random noise information is also a randomly generated 20-bit bitvalue.

The method of training an embedded neural network includes: beforetraining a target neural network model, pre-training a neural networkmodel having the same structure as the target neural network model butwithout watermark information as a reference neural network model;obtaining an untrained embedded neural network model; and using targetwatermark information, weight information of the target neural networkmodel, reference weight information and random noise information as awatermark training set, and performing model training on the untrainedembedded neural network model. In this embodiment, the processspecifically includes: using the weight information of the target neuralnetwork model as an instance of the first watermark training set, usingthe target watermark information as a label of the first watermarktraining set, and using the weight information of the reference neuralnetwork model as an instance of a second watermark training set, andusing the random noise information as a label of the second watermarktraining set; using the first watermark training set and the secondwatermark training set as a training set, updating the weightinformation of the embedded neural network model according to a modelloss function of the embedded neural network model until the model lossfunction converges.

After the above training (after the model loss function converges), theembedded neural network model can output random noise information orwatermark information (label) corresponding to weight information(instance) that is inputted.

In this embodiment, since the weight information of the reference neuralnetwork and random noise information are added in the process oftraining the embedded neural network, when the trained embedded neuralnetwork model needs to satisfy the input data being the weightinformation of the target watermark information that has not beenembedded, the weight information can be mapped to random noiseinformation in order to avoid false alarms. For example, for the weightinformation of the neural network model without watermark information,the embedded neural network model will not extract meaningful watermarkinformation therefrom. Moreover, increasing the amount of data duringthe model training process can prevent the model from overfitting. Inthis embodiment, using an embedded neural network model with multipleneural network layers can enable mapping the weight information and thewatermark information through a nonlinear mapping method. Compared withthe embedded matrix, using the embedded neural network model withmultiple neural network layers can make the embedding process of thewatermark information more complicated, increase the flexibility of theform of the embedded watermark information, and improve the robustnessof the embedded watermark information.

In this embodiment, when training the embedded neural network modelusing the target watermark information and the weight information of thetarget neural network model, the training is performed with the weightinformation of the target neural network model updated in real time. Theprocess of updating the weight information of the target neural networkmodel using the target watermark embedded data provided by the embeddedneural network model and obtaining the target neural network modelembedded with the target watermark information is an iterative trainingprocess. In this iterative training process, the embedded neural networkmodel is cross-trained with the target neural network model, and thetraining set of one neural network model will change with changes of theother neural network model until loss functions of both neural networkmodels converge.

For example, the weight information of the embedded neural network isupdated according to the following model loss function (2):

$\begin{matrix}{\hat{\theta} = {\min\limits_{\theta}\left( {{{Distance}\left( {m^{wm},{{Embedder}\left( {w,\theta} \right)}} \right)} + {{Distance}\mspace{11mu}\left( {m^{random},{{Embedder}\left( {w^{unwm},\theta} \right)}} \right)}} \right)}} & (2)\end{matrix}$

The meaning of each parameter in the formula is:

m^(wm): target watermark information;

m^(random): random noise information;

Embedder: an embedded neural network model;

θ is weight information of the embedded neural network model;

w: weight information of a target neural network model;

w^(unwm): weight information of a reference neural network model;

Distance: used for comparing a degree of similarity between two piecesof information.

The process of updating θ is the process of training the embedded neuralnetwork model (Embedder), so that the embedded neural network model(Embedder) can map the weight information (w) of the target neuralnetwork model to the target watermark information (m^(wm)), and map theweight information of the reference neural network model (w^(unwm)) torandom noise information (m^(random)).

The above-mentioned process of obtaining the target neural network modelembedded with the target watermark information may specifically be:obtaining a regular term used for embedding the watermark informationaccording to the target watermark embedded data; and adding the regularterm used for embedding watermark information on the basis of acorresponding model loss function when the target neural network modelis trained using a conventional training set, updating the weightinformation of the target neural network based on the model lossfunction and the regular term used for embedding watermark information,and obtaining the target neural network model embedded with the targetwatermark information. For example, the weight information of the targetneural network model is updated according to the following formula (3):

$\begin{matrix}{\hat{w} = {\min\limits_{w}\left( {{{loss}_{o}(w)} + {\lambda\;\underset{\underset{{loss}_{embed}}{︸}}{{Distance}\left( {m,{{Embedder}\left( {w,\theta} \right)}} \right)}}} \right)}} & (3)\end{matrix}$

The meaning of each parameter in formula (3) is:

loss_(o): the loss function of the target neural network model;

loss_(embed): the regular term used for embedding the watermarkinformation, which includes watermark information extracted by theembedded neural network model (Embedder) from the weight information ofthe target neural network model;

λ: the coefficient of the regular term (loss_(embed)) to adjust thebalance between the regular term and the loss function (loss_(o)).

In this embodiment, the above-mentioned iterative training processspecifically includes the following content:

A: During the process of training the target neural network model usingthe conventional training set so that the target neural network modelcan realize its predetermined function, first weight information of thetarget neural network model is inputted into the embedded neural networkmodel.

B: First target watermark embedded data outputted by the embedded neuralnetwork model is obtained, and the target watermark embedded dataincludes watermark information extracted by the embedded neural networkmodel from the first weight information of the target neural networkmodel.

C: If the first target watermark embedded data indicates that the targetwatermark information has been embedded in the first weight information,the training of the embedded neural network model is terminated, and thetarget neural network model corresponding to the first weightinformation is determined as the target neural network model embeddedwith the target watermark information. For example, if the first targetwatermark embedded data is the watermark information extracted from thefirst weight information by the embedded neural network model, and thewatermark information is the same as the target watermark information,this indicates that the target watermark information has been embeddedin the first weight information.

D: If the first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the first weightinformation, the embedded neural network model is trained to obtain theembedded neural network model that has completed the first training, andthe first target watermark embedded data is provided to the targetneural network model. For example, the first weight information of thetarget neural network model and the target watermark information is usedas a watermark training set. The weight information of the embeddedneural network model is updated according to the watermark training set,and the embedded neural network model that has completed the firsttraining is obtained, that is, the parameters of the embedded neuralnetwork model are updated once according to the watermark training set.In this embodiment, the process of training the embedded neural networkmodel specifically is: obtaining the first weight information of thereference neural network model, the first weight information of thereference neural network model being not completely embedded with therandom noise information, using the first weight information of thereference neural network model, the random noise information, the firstweight information of the target neural network model, and the targetwatermark information as a watermark training set, and updating theweight information of the embedded neural network model according to thewatermark training set to obtain the embedded neural network model thathas completed the first training.

E: The weight information of the target neural network model is updatedaccording to the first target watermark embedded data to obtain secondweight information of the target neural network model. Specifically, thetraining set of the target neural network model is adjusted according tothe first target watermark embedded data, and during the trainingprocess, the weight information of the target neural network model isupdated according to the adjusted training set.

F: The second weight information of the target neural network model isinputted into the embedded neural network model that has completed thefirst training.

G: Second target watermark embedded data outputted by the embeddedneural network model that has completed the first training is obtained.

H: If the second target watermark embedded data indicates that thetarget watermark information is not fully embedded in the second weightinformation, the training of the embedded neural network model iscontinued to obtain the embedded neural network model that has completedthe second training, and the second target watermark embedded data isprovided to the target neural network model.

I: By analogy, until a target neural network model fully embedded withthe target watermark information and an embedded neural network modelcapable of extracting the target watermark information from the weightinformation of the target neural network model are obtained.

In this embodiment, the precision of the embedded watermark informationcan also be adjusted according to the function or usage scenario of theneural network model. Specifically, the process may be: according to thefunction or usage scenario of the target neural network model, settingthe number of iterations of the iterative training correspondingthereto, or setting a termination condition for the target watermarkembedded data corresponding thereto. For example, when the target neuralnetwork model has many functions or usable scenarios, the method ofembedding watermark information is high-precision embedding.Specifically, the number of iterations of the above iterative trainingcan be set to be the full number of iterations. For example, if thenumber of iterations required for iterative training is 5, the number ofiterations of iterative training is then preset to be 5, or thetermination condition for the target watermark embedded data is set asterminating the training when the target watermark information iscompletely embedded in the weight information. When the target neuralnetwork model has a single function and a relatively few number ofusable scenarios, the method of embedding watermark information islow-precision embedding. For example, the number of iterations of theiterative training is preset to be 3, or the termination condition forthe target watermark embedded data is set as terminating the trainingwhen 60% of the target watermark information is embedded in the weightinformation. In this way, the target neural network model can beembedded in the target watermark information in a dynamic and adaptablemanner.

In this embodiment, the levels of intellectual property protectionrequirements corresponding to neural network models can also bedetermined according to values of different types of the neural networkmodels. When the neural network model is embedded with the watermarkinformation, the precision of the embedded watermark information isadjusted according to the level of the intellectual property protectionrequirement. For example, when the intellectual property protectionrequirement corresponding to the target neural network model isrelatively high, the number of iterations of the above-mentionediterative training can be set to be the full number of iterations, orthe termination condition for the target watermark embedded data can beset as terminating the training when the weight information iscompletely embedded in the target watermark information. When theintellectual property protection requirement corresponding to the targetneural network model is relatively low, the number of iterations of theabove iterative training is set to be not the full number of iterations,or the termination condition for the target watermark embedded data setas terminating the training when the amount of data of the weightinformation that is embedded reaches a predetermined proportion of thetarget watermark information.

In this embodiment, before using the above method to embed the targetwatermark information in the weight information of the target neuralnetwork model, some nodes or neural network layers of the target neuralnetwork model may be deleted. The deleted nodes or neural network layersmay be a node or neural network layer that has a weak correlation withthe main function of the model, and target watermark information iswritten at the corresponding position of the deleted node or neuralnetwork layer in the target neural network model. In this way, a secondembedding of the target watermark information can be realized, whichincreases the complexity of embedding the watermark information in thetarget neural network model.

Model training for deep neural network models is a daunting task, andimplementing this process requires a large amount of data and time. Withthe rapid development of technologies related to deep neural networkmodels, it has become increasingly important to share and promotetrained deep neural network models. For example, to train a ResNet(residual network) with a deep network structure based on the dataset ofImageNet (a large-scale visualization database for visual objectrecognition software research), the process requires a relatively largeamount of time even with the latest GPU (graphics processing unit).Therefore, sharing and promoting the trained deep neural network modelscan maximize the utilization of resources. For example, similar to videosharing websites, through a systematic deep neural network model sharingplatform or an e-commerce platform used for purchasing and sellingtrained deep neural network models, methods such as fine-tuning (usingexisting models to train other data sets) or migration learning, etc.,can be adopted to make the trained deep neural network models to bedirectly applicable to other applications. The trained deep neuralnetwork models are provided to other applications with usagerequirements.

Due to the high time cost and information transmission cost (forexample, a mobile application remotely connects to a server for eachpredictive query, which greatly reduces the usage efficiency of themobile application), in many cases, developers need to embed deep neuralnetwork models into mobile applications for fast response to predictivequeries. However, such setting enables an attacker to simply extractmodel parameters of a deep neural network model from program codes, andmodify the deep neural network model by methods such as migrationlearning, etc., so as to take the deep neural network model as his/herown, and use it for commercial purposes.

In order to protect the intellectual property of deep neural networkmodels in the process of sharing and promoting the deep neural networkmodels, and to prevent the deep neural network models from being stolenand used for other commercial purposes after they are embedded inapplications, in this embodiment, when training a deep neural networkmodel, an embedded neural network model including multiple neuralnetwork layers is used to embed watermark information in the deep neuralnetwork model, which makes the process of embedding the watermarkinformation more complicated, and can enable the detection ofinfringement of the deep neural network model to be performedeffectively. For example, as shown in FIG. 1-B and FIG. 1-C, FIG. 1-B isthe original watermark information to be embedded in a deep neuralnetwork model, and FIG. 1-C is the watermark information extracted fromthe weight information of the deep neural network model after embeddingthe original watermark information in the deep neural network modelusing the watermark information embedding method provided by thisembodiment. As can be seen from FIG. 1-B and FIG. 1-C, the originalwatermark information to be embedded is consistent with the extractedwatermark information. Moreover, using the above fine-tuning method,after modifying the deep neural network model embedded with thewatermark information separately using the same data set and differentdata sets, the extracted watermark information does not changesignificantly from the original watermark information to be embedded.Moreover, after the neural network model embedded with the watermarkinformation is compressed, the extracted watermark information does notchange significantly from the original watermark information to beembedded. Furthermore, using the same method as the watermarkinformation embedding method provided in this embodiment or otherwatermark information embedding methods to overwrite the watermarkinformation embedded in this embodiment, the extracted watermarkinformation is not affected.

In the watermark information embedding method provided in thisembodiment, an embedded neural network model is trained using weightinformation of a target neural network model and target watermarkinformation to be embedded in the target neural network model. Theweight information of the target neural network model is updatedaccording to target watermark embedded data provided by the embeddedneural network model, and a target neural network model embedded withthe target watermark information is obtained. Since the embedded neuralnetwork model includes multiple neural network layers, this methodincreases the complexity of the watermark embedding process and canavoid the problem of relatively poor robustness of watermark informationin existing neural network models with respect to watermark attackmethods such as overwriting attacks and model compression.

A second embodiment of the present disclosure provides a watermarkinformation hiding method, and an implementation entity of the methodmay be an application of a computing device used for hiding watermarkinformation embedded in a neural network. FIG. 2 is a flowchart of awatermark information hiding method provided by the second embodiment ofthe present disclosure. FIG. 2-A is a schematic diagram of watermarkinformation embedded in a hidden target neural network model provided bythe second embodiment of the present disclosure. The method provided inthis embodiment is described in detail using FIG. 2 and FIG. 2-A. Asshown in FIG. 2, a watermark information hiding method 200 provided bythis embodiment includes the following steps:

S201: Obtain reference weight information of a reference neural networkmodel without watermark information embedded.

The reference neural network model may be equivalent to the referenceneural network model in the first embodiment. For the content of thereference neural network, reference can be made to the first embodiment,which will not be repeated herein.

S202: Obtain target weight information of a target neural network modelin which part of the watermark information has been embedded.

For example, the target weight information of the target neural networkmodel in which part of the watermark information has been embedded canbe obtained during the process in which the target neural network modelin the first embodiment is not completely embedded with the targetwatermark information.

The reference neural network model and the target neural network modelhave the same structure. In this embodiment, before starting to trainthe target neural network model, pre-training can be performed on thereference neural network model that has the same structure as the targetneural network model without adding watermark information, and theweight information of the reference neural network model is obtained.

S203: Use the reference weight information and the target weightinformation as a training set to train a detection neural network model,and adjust the model training method of the target neural networkaccording to the distinguishability data between the reference weightinformation and the target weight information outputted by the detectionneural network model to obtain a target neural network model thatsatisfies a watermark information hiding condition.

The detection neural network model is an ordinary neural network model.The input of the trained detection neural network model is sorted targetweight information of a watermark embedding layer of the target neuralnetwork model, and the output is distinguishability data. In thisembodiment, the distinguishability data is a probability value between 0and 1, and is used to judge whether the reference weight information andthe target weight information is distinguishable, so as to judge whetherthe target weight information that is inputted includes watermarkinformation.

The training process of the detection neural network model and thetraining process of the target neural network model when embeddingwatermark information are the processes of adversarial training, thatis, while training the target neural network model (the process ofembedding watermark information), the detection neural network model istrained at the same time. The purpose of training the detection neuralnetwork model is to enable it to distinguish the target weightinformation after embedded with the watermark information from thereference weight information without the watermark information. Whenembedding a watermark in the target neural network model, data itsweight information is further updated according to thedistinguishability data fed back by the detection neural network model,so that its target weight information after embedded with the watermarkinformation is indistinguishable from the reference weight informationwithout watermark information. In the above-mentioned process ofadversarial training, the detection neural network model and the targetneural network model are cross-trained, and the training set of oneneural network model will change as the training set of the other neuralnetwork model changes until the loss functions of the two neural networkmodels converge.

In this embodiment, using the reference weight information and thetarget weight information as the training set to train the detectionneural network model may specifically be:

sorting the reference weight information, and adding label informationthat is not embedded with the watermark information to the sortedreference weight information; sorting the target weight information, andadding label information that is embedded with the watermark informationto the sorted target weight information; and sorting the weightinformation to strengthen the training effect of the detection neuralnetwork model, thereby improving the detection performance of thedetection neural network model.

The sorted reference weight information and its label information isused as the first training sample, and the sorted target weightinformation and its label information is used as the second trainingsample. According to the first training sample and the second trainingsample, the detection neural network model is trained, and the weightinformation of the detection neural network model is updated accordingto the model loss function of the detection neural network model, sothat the detection neural network model can distinguish between thereference weight information and the target weight information.Specifically, the weight information of the detection neural networkmodel can be updated according to the following formula:

$\begin{matrix}{\hat{\theta} = {\max\limits_{\theta}\left( {{\log\mspace{11mu}{{Detector}\left( {w^{unwm};\theta} \right)}} + {\log\left( {1 - {{Detector}\left( {w;\theta} \right)}} \right)}} \right)}} & (5)\end{matrix}$

The meaning of each parameter in the formula is:

Detector: the detection neural network model;

θ: the weight information of the detection neural network model;

w: the target weight information of the target neural network model;

w^(unwm): the reference weight information of the reference neuralnetwork model.

Adjusting the model training method of the target neural networkaccording to the distinguishability data of the reference weightinformation and the target weight information outputted by the detectionneural network model may specifically be:

First, a regular term used for hiding watermark information according tothe distinguishability data is obtained.

On the basis of a corresponding model loss function when a conventionaltraining set is used to train the target neural network model and on thebasis of a regular term used for embedding the watermark information, aregular term used for hiding the watermark information is added.

Based on the model loss function, the regular term used for embeddingwatermark information, and the regular term used for hiding watermarkinformation, the weight information of the target neural network modelis updated.

Specifically, the weight information of the target neural network modelcan be updated according to the following formula:

$\begin{matrix}{\hat{w} = {\min\limits_{w}\left( {{{loss}_{o}(w)} + {{loss}_{R}(w)} - {\lambda\mspace{11mu}\underset{\underset{{loss}_{protect}}{︸}}{\log\mspace{11mu}{{Dectector}\left( {w,\theta} \right)}}}} \right)}} & (6)\end{matrix}$

The meaning of each parameter in the formula is:

w: the target weight information of the target neural network model;

θ: the weight information of the detection neural network model;

loss_(R): a regular term used for embedding the watermark, such asloss_(embed) in the watermark information embedding process of the firstembodiment;

loss_(protect): the distinguishability data returned by the detectionneural network.

The reference weight information and the target weight information isused as the training set to train the detection neural network model.According to the distinguishability data of the reference weightinformation and the target weight information outputted by the detectionneural network model, the model training method of the target neuralnetwork is adjusted to obtain a target neural network model thatsatisfies the watermark information hiding condition. This process is aniterative update process. Both neural network models need to adjust thetraining method according to the training level of the other party,which may specifically be:

A1: Use the reference weight information and the first target weightinformation as a training set to train the detection neural networkmodel; for example, train the detection neural network model by usingthe model training method provided above.

B1: Obtain first distinguishability data of the reference weightinformation and the first target weight information outputted by thedetection neural network model.

C1: Determine the target neural network model corresponding to the firstdistinguishability data as satisfying the target neural network modelthat satisfies the watermark information hiding condition if the firstdistinguishability data indicates that the reference weight informationis indistinguishable from the first target weight information.

D1: Provide the first distinguishability data to the target neuralnetwork model if the first degree of distinguishability data indicatesthat the reference weight information is distinguishable from the firsttarget weight information, to allow the target neural network model toupdate the weight information according to the first distinguishabilitydata and obtains second target weight information.

E1: Use the second target weight information and the reference weightinformation as a training set to train the detection neural networkmodel, and obtain second distinguishability data of the second targetweight information and the reference weight information outputted by thedetection neural network model.

F1: Provide the second distinguishability data to the target neuralnetwork model if the second distinguishability data indicates that thereference weight information is distinguishable from the first targetweight information, to allow the target neural network model to updatethe weight information according to the second distinguishable data andobtain third target weight information.

G1: By analogy, until target distinguishability data that satisfies thepreset watermark information hiding condition is obtained, determine thetarget neural network model corresponding to the targetdistinguishability data as the target neural network model thatsatisfies the watermark information hiding condition.

Existing neural network model watermark embedding algorithms add aregular term in the model training process, so that watermarkinformation can be learned into the weight information of the neuralnetwork. However, the regular term can easily change the weightdistribution of the neural network model, making the watermarkinformation in the neural network model to be detected relativelyeasily. In this case, even if the neural network model is furthertrained to restore the original weight distribution (such as adding anL2 regular term), machine learning models can detect the watermarkinformation from the weight distribution. In order to resist watermarkdetectors based on machine learning technologies, this methodsimultaneously trains the detection neural network model in the processof embedding the watermark information in the target neural networkmodel. Its function is to obtain a probability value of the watermarkinformation included in the weight information of the target neuralnetwork model. This probability value is used as an additional penaltyterm (a regular term used for hiding watermark information) in thetraining process of the target neural network model, while the detectionneural network model is alternately trained using the reference weightinformation of the pre-trained reference neural network model that doesnot include the watermark at the same time. Therefore, adversarialtraining is performed for the target neural network model and thedetection neural network model. The detection neural network model hopesto accurately determine whether the input weight information is embeddedwith the watermark information, and the target neural network modelhopes that the detection neural network model believes that its weightinformation does not include watermark information. According to theprinciple of generative adversarial networks, after the model converges,the detection neural network model cannot distinguish whether the weightinformation of the target neural network model is embedded with thewatermark, and the detection neural network model will output 0.5 forthe weight information of the input target neural network model.Therefore, the watermark information embedded in the weight informationof the target neural network model cannot be detected by the deeplearning model, which can achieve the purpose of hiding the watermarkinformation.

Corresponding to the above-mentioned first embodiment, a thirdembodiment of the present disclosure provides a method for extractingwatermark information. As shown in FIG. 3, a method 300 for extractingwatermark information provided by this embodiment includes the followingsteps:

S301: Obtain a target neural network model.

S302: Obtain target weight information of the target neural networkmodel.

S303: Input the target weight information into an embedded neuralnetwork model, and obtain target watermark information outputted by theembedded neural network model, wherein the embedded neural network modelis obtained by training based on weight information of the target neuralnetwork when watermark information is embedded and original watermarkinformation embedded in the target neural network model, the embeddedneural network model is used for obtaining the watermark informationembedded in the target neural network model based on the weightinformation of the target neural network model. For relevant content ofthe embedded neural network model, reference can be made to the relevantdescription of the first embodiment of the present disclosure, whichwill not be repeated herein.

S304: Match the target watermark information with the original watermarkinformation embedded in the target neural network model to determinewhether the target watermark information is the watermark informationembedded in the target neural network model.

A fourth embodiment of the present disclosure provides a watermarkinformation embedding system, which combines the watermark informationembedding method provided by the first embodiment of the presentdisclosure with the watermark information hiding method provided by thesecond embodiment of the present disclosure. As shown in FIG. 4, thesystem includes:

a data acquisition module 401, a watermark information embedding module402, a watermark information hiding module 403, and a target neuralnetwork model updating module 404.

The data acquisition module 401 is configured to obtain original weightinformation of a target neural network model; obtain target watermarkinformation; obtain reference weight information of a reference neuralnetwork; obtain random noise data; provide the target watermarkinformation, the original weight information, the reference weightinformation and the noise data to the watermark information embeddingmodule; and provide the reference weight information to the watermarkinformation hiding module, the target neural network model and thereference neural network model having the same network structure.

The watermark information embedding module 402 is configured to obtainthe original weight information of the target neural network model;obtain the target watermark information; obtain the reference weightinformation of the reference neural network; obtain random noise data;provide the target watermark information, the original weightinformation, the reference weight information and the noise data to thewatermark information embedding module; and provide the reference weightinformation to the watermark information hiding module, the targetneural network model and the reference neural network model having thesame network structure.

The watermark information hiding module 403 is configured to use weightinformation embedded with watermark information and the reference weightinformation provided by the neural network model updating module as ahidden watermark training set to train a detection neural network model,and obtain distinguishability data of the weight information embeddedwith the watermark information and the reference weight informationoutputted by the neural network model; and provide thedistinguishability data to the neural network model updating module.

The neural network model updating module 404 is configured to update theweight information of the target neural network model in a manner thatenables the target neural network model to realize a predeterminedfunction thereof, and based thereon, update the weight information ofthe target neural network model according to target watermark embeddeddata provided by the watermark information embedding module to obtainthe weight information embedded with the watermark information; providethe weight information embedded with the watermark information to thewatermark information hiding module; update the weight information ofthe target neural network model according to the distinguishability dataprovided by the watermark information hiding module to obtain a targetneural network model embedded with the target watermark information andsatisfying a watermark information hiding condition. As shown in theformula below, a loss function of the target neural network is:

loss_(o)(w) + λ₁loss_(embed)(w) + λ₁loss_(protect)

The above formula represents: according to its original training task(such as an image recognition task), while updating its weightinformation according to the model loss function (loss_(o)), the targetneural network model updates its weight information according to aregular term (loss_(embed)) used for embedding the watermark informationto embed the watermark information, and update its weight informationaccording to a regular term (loss_(protect)) used for hiding thewatermark information at the same time, so as to improve a degree ofhiding of the embedded watermark information.

The first embodiment provides a watermark information embedding method.Correspondingly, a fifth embodiment of the present disclosure alsoprovides a watermark information embedding apparatus. Since theapparatus embodiment is basically similar to the method embodiment, thedescription is relatively simple. For details of related technicalfeatures, reference can be made to corresponding descriptions of themethod embodiments provided above. The following description of theapparatus embodiment is only illustrative.

Referring to FIG. 5 to understand this embodiment, FIG. 5 is a unitblock diagram of a watermark information embedding apparatus provided bythis embodiment. As shown in FIG. 5, the apparatus provided by thisembodiment includes:

a weight information acquisition unit 501 used for obtaining weightinformation of a target neural network model;

a target watermark information acquisition unit 502 used for obtainingtarget watermark information; and

a target neural network model acquisition unit 503 used for training anembedded neural network model using the target watermark information andthe weight information of the target neural network model, and updatethe weight information of the target neural network model according toembedding degree information provided by the embedded neural networkmodel to obtain the embedded neural network model to obtain a targetneural network model embedded with the target watermark information.

In embodiments, using the target watermark information and the weightinformation of the target neural network model to train the embeddedneural network model includes:

obtaining weight information of a pre-trained reference neural networkmodel that does not include the watermark information, the referenceneural network model having the same structure as the target neuralnetwork model;

obtaining random noise information, the random noise information havingthe same structure as the target watermark information; and

training the embedded neural network model according to the weightinformation of the reference neural network model, the random noiseinformation, the weight information of the target neural network modeland the target watermark information.

In embodiments, training the embedded neural network model according tothe weight information of the reference neural network model, the randomnoise information, the weight information of the target neural networkmodel and the target watermark information includes:

using the weight information of the target neural network model as aninstance of a first watermark training set, using the target watermarkinformation as a label of the first watermark training set, using theweight information of the reference neural network model as an instanceof a second watermark training set, and using the random noise as alabel of the second watermark training set; and

using the first watermark training set and the second watermark trainingset as a training set, updating the weight information of the embeddedneural network model according to a model loss function of the embeddedneural network model until the model loss function converges.

In embodiments, while training the target neural network model, updatingthe weight information of the target neural network model according tothe target watermark embedded data provided by the embedding neuralnetwork model to obtain the target neural network model embedded withthe target watermark information includes:

inputting first weight information of the target neural network modelinto the embedded neural network model;

obtaining first target watermark embedded data outputted by the embeddedneural network model, the target watermark embedded data includingwatermark information extracted by the embedding neural network modelfrom the first weight information of the target neural network model;

if the first target watermark embedded data indicates that the targetwatermark information has been embedded in the first weight information,terminating training of the embedded neural network model, anddetermining the target neural network model corresponding to the firstweight information as the target neural network model embedded with thetarget watermark information;

if the first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the first weightinformation, training the embedding neural network model to obtain anembedded neural network model that completes the first training, andproviding the first target watermark embedded data to the target neuralnetwork model;

updating the weight information of the target neural network modelaccording to the first target watermark embedded data, and obtainingsecond weight information of the target neural network model;

inputting the second weight information of the target neural networkmodel into the embedded neural network model that completes the firsttraining; and

by analogy, until a target neural network model that has completelyembedded with the target watermark information and an embedded neuralnetwork model that is able to extract the target watermark informationfrom the weight information of the target neural network model areobtained.

In embodiments, if the first target watermark embedded data indicatesthat the target watermark information is not completely embedded in thetarget neural network model, training the embedded neural network modelto obtain the embedded neural network model that completes the firsttraining includes:

using the first weight information of the target neural network modeland the target watermark information as a watermark training set,updating the weight information of the embedded neural network modelaccording to the watermark training set to obtain the embedded neuralnetwork model that completes the first training.

In embodiments, if the first target watermark embedded data indicatesthat the target watermark information is not completely embedded in thetarget neural network model, training the embedded neural network modelto obtain the embedded neural network model that completes the firsttraining includes:

obtaining random noise information, the random noise information havingthe same structure as the target watermark information;

obtaining first weight information of the reference neural networkmodel, wherein the reference neural network and the target neuralnetwork have the same structure, and random noise information is notcompletely embedded in the first weight information of the referenceneural network model;

using the first weight information of the reference neural networkmodel, the random noise information, the first weight information of thetarget neural network model, and the target watermark information as awatermark training set, updating the weight information of the embeddedneural network model according to the watermark training set to obtainthe embedded neural network model that completes the first training.

In embodiments, updating the weight information of the target neuralnetwork model according to the target watermark embedded data providedby the embedded neural network model to obtain the target neural networkmodel embedded with the target watermark information includes:

obtaining a regular term used for embedding watermark informationaccording to the target watermark embedded data;

on a basis of a model loss function corresponding to training the targetneural network model using a conventional training set, adding theregular term used for embedding the watermark information; and

updating the weight information of the target neural network to obtainthe target neural network model embedded with the target watermarkinformation based on the model loss function and the regular term usedfor embedding the watermark information.

In the foregoing embodiments, a watermark information embedding methodand a watermark information embedding apparatus are provided. Inaddition, a sixth embodiment of the present disclosure also provides anelectronic device. Since the electronic device embodiment is basicallysimilar to the method embodiment, a description thereof is relativelysimple. For details of related technical features, reference can be madeto corresponding descriptions of the method embodiments provided above.The following description of the electronic device embodiment is onlyillustrative. An embodiment of the electronic device is as follows:

Referring to FIG. 6 to understand this embodiment, FIG. 6 is a schematicdiagram of an electronic device provided in this embodiment.

As shown in FIG. 6, the electronic device includes: a processor 601 anda memory 602.

The memory 602 is configured to store a watermark information embeddingprogram. When the program is read and executed by the processor, thefollowing operations are performed:

obtaining weight information of a target neural network model;

obtaining target watermark information; and

using the target watermark information and the weight information of thetarget neural network model to train an embedded neural network model,and updating the weight information of the target neural network modelaccording to target watermark embedded data provided by the embeddedneural network model to obtain a target neural network model embeddedwith the target watermark information,

wherein the embedded neural network model is used for obtaining thetarget watermark embedded data according to the weight information ofthe target neural network model, and the target watermark embedded datais used for representing an embedding degree of watermark informationembedded in the target neural network model.

In embodiments, using the target watermark information and the weightinformation of the target neural network model to train the embeddedneural network model includes:

obtaining weight information of a pre-trained reference neural networkmodel that does not include watermark information, the reference neuralnetwork model having the same structure as the target neural networkmodel;

obtaining random noise information, the random noise information havingthe same structure as the target watermark information; and

training the embedded neural network model according to the weightinformation of the reference neural network model, the random noiseinformation, the weight information of the target neural network modeland the target watermark information.

In embodiments, training the embedded neural network model according tothe weight information of the reference neural network model, the randomnoise information, the weight information of the target neural networkmodel and the target watermark information includes:

using the weight information of the target neural network model as aninstance of a first watermark training set, using the target watermarkinformation as a label of the first watermark training set, using theweight information of the reference neural network model as an instanceof a second watermark training set, and using the random noiseinformation as a label of the second watermark training set; and

using the first watermark training set and the second watermark trainingset as a training set, updating the weight information of the embeddedneural network model according to a model loss function of the embeddedneural network model until the model loss function converges.

In embodiments, while training the target neural network model, updatingthe weight information of the target neural network model according tothe target watermark embedded data provided by the embedding neuralnetwork model to obtain the target neural network model embedded withthe target watermark information includes:

inputting first weight information of the target neural network modelinto the embedded neural network model;

obtaining first target watermark embedded data outputted by the embeddedneural network model, the target watermark embedded data includingwatermark information extracted by the embedded neural network modelfrom the first weight information of the target neural network model;

if the first target watermark embedded data indicates that the targetwatermark information has been embedded in the first weight information,terminating training of the embedded neural network model, anddetermining a target neural network model corresponding to the firstweight information as the target neural network model embedded with thetarget watermark information;

If the first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the first weightinformation, training the embedded neural network model to obtain anembedded neural network model that completes first training, andproviding the first target watermark embedded data to the target neuralnetwork model;

updating the weight information of the target neural network modelaccording to the first target watermark embedded data, and obtainingsecond weight information of the target neural network model;

inputting the second weight information of the target neural networkmodel into the embedded neural network model that completes the firsttraining;

by analogy, until a target neural network model that has completelyembedded with the target watermark information and an embedded neuralnetwork model that is able to extract the target watermark informationfrom the weight information of the target neural network model areobtained.

In embodiments, if the first target watermark embedded data indicatesthat the target watermark information is not completely embedded in thetarget neural network model, training the embedded neural network modelto obtain the embedded neural network model that completes the firsttraining includes:

using the first weight information of the target neural network modeland the target watermark information as a watermark training set,updating the weight information of the embedded neural network modelaccording to the watermark training set to obtain the embedded neuralnetwork model that completes the first training.

In embodiments, if the first target watermark embedded data indicatesthat the target watermark information is not completely embedded in thetarget neural network model, training the embedded neural network modelto obtain the embedded neural network model that completes the firsttraining includes:

obtaining random noise information, the random noise information havingthe same structure as the target watermark information;

obtaining first weight information of the reference neural networkmodel, wherein the reference neural network and the target neuralnetwork have the same structure, and random noise information is notcompletely embedded in the first weight information of the referenceneural network model;

using the first weight information of the reference neural networkmodel, the random noise information, the first weight information of thetarget neural network model, and the target watermark information as awatermark training set, updating the weight information of the embeddedneural network model according to the watermark training set to obtainthe embedded neural network model that completes the first training.

In embodiments, updating the weight information of the target neuralnetwork model according to the target watermark embedded data providedby the embedded neural network model to obtain the target neural networkmodel embedded with the target watermark information includes:

obtaining a regular term used for embedding watermark informationaccording to the target watermark embedded data;

on a basis of a model loss function corresponding to training the targetneural network model using a conventional training set, adding theregular term used for embedding the watermark information; and updatingthe weight information of the target neural network to obtain the targetneural network model embedded with the target watermark informationbased on the model loss function and the regular term used for embeddingthe watermark information.

The second embodiment provides a watermark information hiding method.Correspondingly, a seventh embodiment of the present disclosure alsoprovides a watermark information hiding apparatus. Since the apparatusembodiment is basically similar to the method embodiment, a descriptionthereof is relatively simple. For details of related technical features,reference can be made to corresponding descriptions of the methodembodiments provided above. The following description of the apparatusembodiment is only illustrative.

Referring to FIG. 7 to understand this embodiment, FIG. 7 is a unitblock diagram of the apparatus provided by this embodiment. As shown inFIG. 7, the watermark information hiding apparatus provided by thisembodiment includes:

a reference weight information acquisition unit 701 configured to obtainreference weight information of a reference neural network model that isnot embedded with watermark information;

a target weight information acquisition unit 702 configured to obtaintarget weight information of a target neural network model embedded witha part of the watermark information, the reference neural network modeland the target neural network model having the same structure; and

a target neural network model acquisition unit 703 configured to use thereference weight information and the target weight information as atraining set to train a detection neural network model, and adjust amodel training method of the target neural network model according todistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel to obtain a target neural network model that satisfies a watermarkinformation hiding condition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model, and adjusting the model training method of the targetneural network according to the distinguishability data of the referenceweight information and the target weight information outputted by thedetection neural network model method to obtain the target neuralnetwork model that satisfies the watermark information hiding condition,includes:

using the reference weight information and the first target weightinformation as the training set to train the detection neural networkmodel;

obtaining first distinguishability data of the reference weightinformation and the first target weight information outputted by thedetection neural network model;

if the first distinguishability data indicates that the reference weightinformation is indistinguishable from the first target weightinformation, determining that a target neural network modelcorresponding to the first distinguishability data is the target neuralnetwork model that satisfies the watermark information hiding condition;

If the first distinguishability data indicates that the reference weightinformation is distinguishable from the first target weight information,providing the first distinguishability data to the target neural networkmodel for the target neural network model to update the weightinformation according to the first distinguishability data informationto obtain second target weight information;

using the reference weight information and the second target weightinformation as the training set to train the detection neural networkmodel;

by analogy, until target distinguishability data satisfying a presetwatermark information hiding condition is obtained, and a target neuralnetwork model corresponding to the target distinguishability data isdetermined as the target neural network model that satisfies thewatermark information hiding condition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes:

sorting the reference weight information, and adding label informationthat is not embedded with watermark information to the sorted referenceweight information;

sorting the target weight information, and adding label informationembedded with watermark information to the sorted target weightinformation; and

using the sorted reference weight information and the label informationthereof as a first training sample, using the sorted target weightinformation and the label information thereof as a second trainingsample, and training the detection neural network model according to thefirst training sample and the second training sample, to enable thedetection neural network model to distinguish between the referenceweight information and the target weight information.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes: using the reference weight information and thetarget weight information as the training set, and updating the weightinformation of the detection neural network model according to a modelloss function of the detection neural network model.

In embodiments, adjusting the model training method of the target neuralnetwork according to the distinguishability data of the reference weightinformation and the target weight information outputted by the detectionneural network model includes:

obtaining a regular term used for hiding the watermark informationaccording to the distinguishability data;

on a basis of a model loss function corresponding to training of thetarget neural network model using a conventional training set, and on abasis of a regular term used for embedding the watermark information,adding the regular term used for hiding the watermark information toobtain a target loss function corresponding to the target neural networkmodel; and

updating the weight information of the target neural network model basedon the target loss function.

In the foregoing embodiments, a watermark information hiding method anda watermark information hiding apparatus are provided. In addition, aneighth embodiment of the present disclosure also provides an electronicdevice. Since the electronic device embodiment is basically similar tothe method embodiment, a description thereof is relatively simple. Fordetails of related technical features, reference can be made tocorresponding descriptions of the method embodiments provided above. Thefollowing description of the electronic device embodiment is onlyillustrative. An example of the electronic device is as follows:

Referring to FIG. 8 to understand this embodiment, FIG. 8 is a schematicdiagram of an electronic device provided in this embodiment.

As shown in FIG. 8, the electronic device includes: a processor 801 anda memory 802.

The memory 802 is configured to store a watermark information hidingprogram. When the program is read and executed by the processor, thefollowing operations are performed:

obtaining reference weight information of a reference neural networkmodel that is not embedded with watermark information;

obtaining target weight information of a target neural network modelembedded with a part of the watermark information, the reference neuralnetwork model having the same structure as the target neural networkmodel;

using the reference weight information and the target weight informationas a training set to train a detection neural network model, andadjusting a model training method of the target neural network modelaccording to distinguishability data of the reference weight informationand the target weight information outputted by the detection neuralnetwork model to obtain a target neural network model that satisfies awatermark information hiding condition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model, and adjusting the model training method of the targetneural network according to the distinguishability data of the referenceweight information and the target weight information outputted by thedetection neural network model method to obtain the target neuralnetwork model that satisfies the watermark information hiding condition,includes:

using the reference weight information and the first target weightinformation as the training set to train the detection neural networkmodel;

obtaining first distinguishability data of the reference weightinformation and the first target weight information outputted by thedetection neural network model;

if the first distinguishability data indicates that the reference weightinformation is indistinguishable from the first target weightinformation, determining that a target neural network modelcorresponding to the first distinguishability data is the target neuralnetwork model that satisfies the watermark information hiding condition;

If the first distinguishability data indicates that the reference weightinformation is distinguishable from the first target weight information,providing the first distinguishability data to the target neural networkmodel for the target neural network model to update the weightinformation according to the first distinguishability data informationto obtain second target weight information;

using the reference weight information and the second target weightinformation as the training set to train the detection neural networkmodel;

by analogy, until target distinguishability data satisfying a presetwatermark information hiding condition is obtained, and a target neuralnetwork model corresponding to the target distinguishability data isdetermined as the target neural network model that satisfies thewatermark information hiding condition.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes:

sorting the reference weight information, and adding label informationthat is not embedded with watermark information to the sorted referenceweight information;

sorting the target weight information, and adding label informationembedded with watermark information to the sorted target weightinformation; and

using the sorted reference weight information and the label informationthereof as a first training sample, using the sorted target weightinformation and the label information thereof as a second trainingsample, and training the detection neural network model according to thefirst training sample and the second training sample, to enable thedetection neural network model to distinguish between the referenceweight information and the target weight information.

In embodiments, using the reference weight information and the targetweight information as the training set to train the detection neuralnetwork model includes: using the reference weight information and thetarget weight information as the training set, and updating the weightinformation of the detection neural network model according to a modelloss function of the detection neural network model.

In embodiments, adjusting the model training method of the target neuralnetwork according to the distinguishability data of the reference weightinformation and the target weight information outputted by the detectionneural network model includes:

obtaining a regular term used for hiding the watermark informationaccording to the distinguishability data;

on a basis of a model loss function corresponding to training of thetarget neural network model using a conventional training set, and on abasis of a regular term used for embedding the watermark information,adding the regular term used for hiding the watermark information toobtain a target loss function corresponding to the target neural networkmodel; and

updating the weight information of the target neural network model basedon the target loss function.

The third embodiment provides a method for extracting watermarkinformation. Correspondingly, a ninth embodiment of the presentdisclosure also provides an apparatus for extracting watermarkinformation. Since the apparatus embodiment is basically similar to themethod embodiment, a description thereof is relatively simple. Fordetails of the related technical features, reference can be made tocorresponding descriptions of the method embodiments provided above. Thefollowing description of the apparatus embodiment is only illustrative.

Referring to FIG. 9 to understand this embodiment, FIG. 9 is a unitblock diagram of an apparatus provided by this embodiment. As shown inFIG. 9, the apparatus provided by this embodiment includes:

a target neural network model acquisition unit 901 configured to obtaina target neural network model;

a target weight information acquisition unit 902 configured to obtaintarget weight information of the target neural network model;

a target watermark information acquisition unit 903 configured to inputthe target weight information into an embedded neural network model toobtain the target watermark information outputted by the embedded neuralnetwork model, wherein the embedded neural network model is obtained bytraining according to weight information of the target neural networkmodel when the watermark information is embedded and original watermarkinformation embedded in the target neural network model, and theembedded neural network model is used for obtaining the watermarkinformation embedded in the target neural network model according to theweight information of the target neural network model;

a watermark information matching unit 904 configured to match the targetwatermark information with the original watermark information embeddedin the target neural network model, and determine whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

In the foregoing embodiments, a watermark information extraction methodand a watermark information extraction apparatus are provided. Inaddition, a tenth embodiment of the present disclosure also provides anelectronic device. Since the electronic device embodiment is basicallysimilar to the method embodiment, a description thereof is relativelysimple. For details of related technical features, reference can be madeto corresponding descriptions of the method embodiments provided above.The following description of the electronic device embodiment is onlyillustrative. An example of the electronic device is as follows:

Referring to FIG. 10 to understand this embodiment, FIG. 10 is aschematic diagram of an electronic device provided in this embodiment.

As shown in FIG. 10, the electronic device includes: a processor 1001and a memory 1002.

The memory 1002 is configured to store a watermark informationextraction program. When the program is read and executed by theprocessor, the following operations are performed:

obtaining a target neural network model; obtaining target weightinformation of the target neural network model; inputting the targetweight information into an embedded neural network model to obtain thetarget watermark information outputted by the embedded neural networkmodel, wherein the embedded neural network model is obtained by trainingaccording to weight information of the target neural network model whenthe watermark information is embedded and original watermark informationembedded in the target neural network model, and the embedded neuralnetwork model is used for obtaining the watermark information embeddedin the target neural network model according to the weight informationof the target neural network model; matching the target watermarkinformation with the original watermark information embedded in thetarget neural network model, and determining whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

In embodiments, an apparatus (such as the apparatuses as shown in FIGS.5, 7, and 9), a system (such as the system as shown in FIG. 4), and acomputing device (such as the electronic devices as shown in FIGS. 6, 8,and 10) may each include one or more processors (CPUs), an input/outputinterface, a network interface, and a memory.

The memory may include a form of computer readable media such as avolatile memory, a random access memory (RAM) and/or a non-volatilememory, for example, a read-only memory (ROM) or a flash RAM. The memoryis an example of a computer readable media.

1. The computer readable media may include a volatile or non-volatiletype, a removable or non-removable media, which may achieve storage ofinformation using any method or technology. The information may includea computer readable instruction, a data structure, a program module orother data. Examples of computer storage media include, but not limitedto, phase-change memory (PRAM), static random access memory (SRAM),dynamic random access memory (DRAM), other types of random-access memory(RAM), read-only memory (ROM), electronically erasable programmableread-only memory (EEPROM), quick flash memory or other internal storagetechnology, compact disk read-only memory (CD-ROM), digital versatiledisc (DVD) or other optical storage, magnetic cassette tape, magneticdisk storage or other magnetic storage devices, or any othernon-transmission media, which may be used to store information that maybe accessed by a computing device. As defined herein, the computerreadable media does not include transitory media, such as modulated datasignals and carrier waves.

2. One skilled in the art should understand that the embodiments of thepresent disclosure may be provided as methods, systems or computerprogram products. Accordingly, the present disclosure may take a form ofan entirely hardware embodiment, an entirely software embodiment, or anembodiment of a combination of software and hardware aspects.Furthermore, the present disclosure may take a form of a computerprogram product embodied on one or more computer-usable storage media(which include, but are not limited to, a magnetic storage, CD-ROM, anoptical storage, etc.) having computer-usable program codes.

Although the present disclosure is disclosed above with preferredembodiments, they are not intended to limit the present disclosure. Oneskilled in the art can make possible changes and modifications withoutdeparting from the spirit and scope of the present disclosure.Therefore, the scope of protection of the present disclosure shall besubject to the scope defined by the claims of the present disclosure.

The present disclosure can be further understood using the followingclauses.

Clause 1: A method for embedding watermark information, comprising:obtaining weight information of a target neural network model; obtainingtarget watermark information; and using the target watermark informationand the weight information of the target neural network model to trainan embedded neural network model, and updating the weight information ofthe target neural network model according to target watermark embeddeddata provided by the embedded neural network model to obtain the targetneural network model embedded with the target watermark information,wherein the embedded neural network model is used for obtaining thetarget watermark embedded data according to the weight information ofthe target neural network model, and the target watermark embedded datais used for representing an embedding degree of embedded watermarkinformation in the target neural network model.

Clause 2: The method according to Clause 1, wherein using the targetwatermark information and the weight information of the target neuralnetwork model to train the embedded neural network model comprises:obtaining weight information of a pre-trained reference neural networkmodel without the watermark information embedded, the reference neuralnetwork model and the target neural network having a same structure;obtaining random noise information, the random noise information and thetarget watermark information having a same structure; and training theembedded neural network model according to the weight information of thereference neural network model, the random noise information, the weightinformation of the target neural network model and the target watermarkinformation.

Clause 3: The method according to Clause 2, wherein training theembedded neural network model according to the weight information of thereference neural network model, the random noise information, the weightinformation of the target neural network model, and the target watermarkinformation comprises: using the weight information of the target neuralnetwork model as an instance of a first watermark training set, usingthe target watermark information as a label of the first watermarktraining set, and using the weight information of the reference neuralnetwork model as an instance of a second watermark training set, andusing the random noise information as a label of the second watermarktraining set; and using the first watermark training set and the secondwatermark training set as a training set, updating the weightinformation of the embedded neural network model according to a modelloss function of the embedded neural network model until the model lossfunction converges.

Clause 4: The method according to Clause 1, wherein updating the weightinformation of the target neural network model according to the targetwatermark embedded data provided by the embedded neural network model toobtain the target neural network model embedded with the targetwatermark information comprises: inputting first weight information ofthe target neural network model into the embedded neural network model;obtaining first target watermark embedded data outputted by the embeddedneural network model, the target watermark embedded data includingwatermark information extracted from the first weight information of thetarget neural network model by the embedded neural network model;terminating the training of the embedded neural network model if thefirst target watermark embedded data indicates that the target watermarkinformation has been embedded in the first weight information, anddetermining that a target neural network model corresponding to thefirst weight information as the target neural network model embeddedwith the target watermark information; training the embedded neuralnetwork model if the first target watermark embedded data indicates thatthe target watermark information is not completely embedded in the firstweight information to obtain an embedded neural network model thatcompletes a first training, and providing the first target watermarkembedded data to the target neural network model; updating the weightinformation of the target neural network model according to the firsttarget watermark embedded data to obtain second weight information ofthe target neural network model; inputting the second weight informationof the target neural network model to the embedded neural network modelthat completes the first training; and by analogy, until the targetneural network model that is completely embedded with the targetwatermark information and the target watermark information of theembedded neural network model that is able to be extracted from theweight information of the target neural network model are obtained.

Clause 5: The method according to Clause 4, wherein training theembedded neural network model to obtain the embedded neural networkmodel that completes the first training if the first target watermarkembedded data indicates that the target watermark information is notcompletely embedded in the target neural network model, comprises: usingthe first weight information of the target neural network model and thetarget watermark information as a watermark training set, updating theweight information of the embedded neural network model according to thewatermark training set to obtain the embedded neural network model thatcompletes the first training.

Clause 6: The method according to Clause 4, wherein training theembedded neural network model to obtain the embedded neural networkmodel that completes the first training if the first target watermarkembedded data indicates that the target watermark information is notcompletely embedded in the target neural network model, comprises:obtaining random noise information, the random noise information havinga same structure as the target watermark information; obtaining firstweight information of a reference neural network model, the referenceneural network and the target neural network having a same structure,wherein the random noise information is not completely embedded in thefirst weight information of the reference neural network model; andusing the first weight information of the reference neural networkmodel, the random noise information, the first weight information of thetarget neural network model, and the target watermark information as awatermark training set, and updating the weight information of theembedded neural network model according to the watermark training set toobtain the embedded neural network model that completes the firsttraining.

Clause 7: The method according to Clause 1, wherein updating the weightinformation of the target neural network model according to the targetwatermark embedded data provided by the embedded neural network model toobtain the target neural network model embedded with the targetwatermark information comprises: obtaining a regular term for embeddingthe watermark information according to the target watermark embeddeddata; adding the regular term for embedding the watermark information ona basis of a corresponding model loss function when the target neuralnetwork model is trained using a conventional training set; and updatingthe weight information of the target neural network based on the modelloss function and the regular term for embedding the watermarkinformation, and obtaining the target neural network model embedded withthe target watermark information.

Clause 8: A watermark information hiding method, comprising: obtainingreference weight information of a reference neural network model that isnot embedded with watermark information; obtaining target weightinformation of a target neural network model that is embedded withpartial watermark information, the reference neural network model andthe target neural network model having a same structure; and using thereference weight information and the target weight information as atraining set to train a detection neural network model, and adjusting amodel training method of the target neural network model according todistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel, and obtaining a target neural network model that satisfies awatermark information hiding condition.

Clause 9: The method according to Clause 8, wherein using the referenceweight information and the target weight information as the training setto train the detection neural network model, and adjusting the modeltraining method of the target neural network model according to thedistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel to obtain the target neural network model that satisfies thewatermark information hiding condition, comprise: using the referenceweight information and the first target weight information as thetraining set to train the detection neural network model; obtainingfirst distinguishability data of the reference weight information andthe first target weight information outputted by the detection neuralnetwork model; determining a target neural network model correspondingto the first distinguishability data as the target neural network modelthat satisfies the watermark information hiding condition if the firstdistinguishability data indicates that the reference weight informationand first target weight information is indistinguishable; providing thefirst distinguishability data to the target neural network model toallow the target neural network model to update the weight informationaccording to the first distinguishability data and obtain second targetweight information if the first distinguishability data indicates thatthe reference weight information is distinguishable from the firsttarget weight information; using the reference weight information andthe second target weight information as the training set to train thedetection neural network model; and by analogy, until targetdistinguishability data satisfying a preset watermark information hidingcondition is obtained, and a target neural network model correspondingto the target distinguishability data is determined as the target neuralnetwork model that satisfies the watermark information hiding condition.

Clause 10: The method according to Clause 8, wherein using the referenceweight information and the target weight information as the training setto train the detection neural network model comprises: sorting thereference weight information, and adding label information that is notembedded with watermark information to the sorted reference weightinformation; sorting the target weight information, and add labelinformation that is embedded with watermark information to the sortedtarget weight information; and using the sorted reference weightinformation and the label information thereof as a first trainingsample, using the sorted target weight information and the labelinformation thereof as a second training sample, training the detectionneural network model according to the first training sample and thesecond training sample, to enable the detection neural network model tobe able to distinguish between the reference weight information and thetarget weight information.

Clause 11: The method according to Clause 8, wherein using the referenceweight information and the target weight information as the training setto train the detection neural network model comprises: using thereference weight information and the target weight information as thetraining set, and updating the weight information of the detectionneural network model according to a model loss function of the detectionneural network model.

Clause 12: The method according to Clause 8, wherein adjusting the modeltraining method of the target neural network model according to thedistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel comprises: obtaining a regular term used for hiding the watermarkinformation according to the distinguishability information; adding theregular term used for hiding the watermark information on a basis of acorresponding model loss function when a conventional training set isused to train the target neural network model and a regular term usedfor embedding the watermark information, and obtaining a target lossfunction corresponding to the target neural network model; and updatingthe weight information of the target neural network model based on thetarget loss function.

Clause 13: A method for extracting watermark information, comprising:obtaining a target neural network model; obtaining target weightinformation of the target neural network model; inputting the targetweight information into an embedded neural network model to obtaintarget watermark information outputted by the embedded neural networkmodel, wherein the embedded neural network model is obtained by trainingaccording to weight information of the target neural network model whenthe watermark information is embedded and original watermark informationembedded in the target neural network model, and the embedded neuralnetwork model is used for obtaining the watermark information embeddedin the target neural network model according to the weight informationof the target neural network model; and matching the target watermarkinformation with the original watermark information embedded in thetarget neural network model, and determining whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

Clause 14: An apparatus for embedding watermark information, comprising:a weight information acquisition unit used for obtaining weightinformation of a target neural network model; a target watermarkinformation acquisition unit used for obtaining target watermarkinformation; an embedded neural network model training unit used forusing the target watermark information and the weight information of thetarget neural network model to train an embedded neural network model,and updating the weight information of the target neural network modelaccording to embedding degree information provided by the embeddedneural network model to obtain a target neural network model embeddedwith the target watermark information.

Clause 15: An electronic device comprising: a processor; and a memorybeing used for storing a watermark information embedding program, andthe program, when being read and executed by the processor, performingthe following operations: obtaining weight information of a targetneural network model; obtaining target watermark information; and usingthe target watermark information and the weight information of thetarget neural network model to train an embedded neural network model,and updating the weight information of the target neural network modelaccording to target watermark embedded data provided by the embeddedneural network model to obtain a target neural network model embeddedwith the target watermark information, wherein the embedded neuralnetwork model is used for obtaining the target watermark embedded dataaccording to the weight information of the target neural network model,and the target watermark embedded data is used for representing anembedding degree of embedded watermark information in the target neuralnetwork model.

Clause 16: A watermark information hiding apparatus, comprising: areference weight information acquisition unit used for obtainingreference weight information of a reference neural network model that isnot embedded with watermark information; a target weight informationacquisition unit used for obtaining target weight information of atarget neural network model that is embedded with partial watermarkinformation, the reference neural network model and the target neuralnetwork model having a same structure; and a target neural network modelacquisition unit used for using the reference weight information and thetarget weight information as a training set to train a detection neuralnetwork model, and adjusting a model training method of the targetneural network model according to distinguishability data of thereference weight information and the target weight information outputtedby the detection neural network model, and obtaining a target neuralnetwork model that satisfies a watermark information hiding condition.

Clause 17: An electronic device comprising: a processor; and a memorybeing used for storing a watermark information hiding program, and theprogram when being read and executed by the processor, performing thefollowing operations: obtaining reference weight information of areference neural network model that is not embedded with watermarkinformation; obtaining target weight information of a target neuralnetwork model that is embedded with partial watermark information, thereference neural network model and the target neural network modelhaving a same structure; and using the reference weight information andthe target weight information as a training set to train a detectionneural network model, and adjusting a model training method of thetarget neural network model according to distinguishability data of thereference weight information and the target weight information outputtedby the detection neural network model, and obtaining a target neuralnetwork model that satisfies a watermark information hiding condition.

Clause 18: An apparatus for extracting watermark information,comprising: a target neural network model acquisition unit used forobtaining a target neural network model; a target weight informationacquisition unit used for obtaining target weight information of thetarget neural network model; a target watermark information acquisitionunit used for inputting the target weight information into an embeddedneural network model to obtain target watermark information outputted bythe embedded neural network model, wherein the embedded neural networkmodel is obtained by training according to weight information of thetarget neural network model when the watermark information is embeddedand original watermark information embedded in the target neural networkmodel, and the embedded neural network model is used for obtaining thewatermark information embedded in the target neural network modelaccording to the weight information of the target neural network model;and a watermark information matching unit used for matching the targetwatermark information with the original watermark information embeddedin the target neural network model, and determining whether the targetwatermark information is the watermark information embedded in thetarget neural network model.

Clause 19: An electronic device comprising: a processor; and a memorybeing used for storing a watermark information extraction program for aneural network, and the program, when being read and executed by theprocessor, performing the following operations: obtaining a targetneural network model; obtaining target weight information of the targetneural network model; inputting the target weight information into anembedded neural network model to obtain target watermark informationoutputted by the embedded neural network model, wherein the embeddedneural network model is obtained by training according to weightinformation of the target neural network model when the watermarkinformation is embedded and original watermark information embedded inthe target neural network model; the embedded neural network model isused for obtaining the watermark information embedded in the targetneural network model according to the weight information of the targetneural network model; and matching the target watermark information withthe original watermark information embedded in the target neural networkmodel, and determining whether the target watermark information is thewatermark information embedded in the target neural network model.

Clause 20: A watermark information embedding system, comprising: a dataacquisition module, a watermark information embedding module, awatermark information hiding module, and a target neural network modelupdating module; the data acquisition module being used for obtainingoriginal weight information of a target neural network model; obtainingtarget watermark information; obtaining reference weight information ofa reference neural network model; obtaining random noise data; providingthe reference weight information and the noise data to the watermarkinformation embedding module; and providing the reference weightinformation to the watermark information hiding module, the targetneural network model and the reference neural network model having asame network structure; the watermark information embedding module beingused for training an embedded neural network model using the targetwatermark information, the original weight information, the referenceweight information and the noise data as an embedded watermark trainingset, and obtaining the target watermark embedded data outputted by theembedded neural network model, the target watermark embedded data beingused to represent an embedding degree of embedded watermark informationin the target neural network model; and providing the target watermarkembedded data to the neural network model updating module; the watermarkinformation hiding module being used for training a detection neuralnetwork model using the weight information embedded with watermarkinformation and the reference weight information provided by the neuralnetwork model updating module as a hidden watermark training set, andobtaining distinguishability data of the weight information embeddedwith the watermark information and the reference weight informationoutputted by the detection neural network model; and providing thedistinguishability data to the neural network model updating module; andthe neural network model updating module being used for updating theweight information of the target neural network model in a manner thatenables the target neural network model to achieve predeterminedfunctions thereof, updating the weight information of the target neuralnetwork model on a basis thereof according to target watermark embeddeddata provided by the watermark information embedding module, andobtaining the weight information embedded with the watermarkinformation; providing the weight information embedded with thewatermark information to the watermark information hiding module; andupdating the weight information of the target neural network modelaccording to the distinguishability data provided by the watermarkinformation hiding module, and obtaining a target neural network modelembedded with the target watermark information and satisfying awatermark information hiding condition.

What is claimed is:
 1. A method implemented by a computing device, themethod comprising: obtaining weight information of a target neuralnetwork model; obtaining target watermark information; and using thetarget watermark information and the weight information of the targetneural network model to train an embedded neural network model, andupdating the weight information of the target neural network modelaccording to target watermark embedded data provided by the embeddedneural network model to obtain the target neural network model embeddedwith the target watermark information.
 2. The method according to claim1, wherein using the target watermark information and the weightinformation of the target neural network model to train the embeddedneural network model comprises: obtaining weight information of apre-trained reference neural network model without the watermarkinformation embedded, the pre-trained reference neural network model andthe target neural network model having a same structure; obtainingrandom noise information, the random noise information and the targetwatermark information having a same structure; and training the embeddedneural network model according to the weight information of thereference neural network model, the random noise information, the weightinformation of the target neural network model and the target watermarkinformation.
 3. The method according to claim 2, wherein training theembedded neural network model according to the weight information of thereference neural network model, the random noise information, the weightinformation of the target neural network model, and the target watermarkinformation comprises: using the weight information of the target neuralnetwork model as an instance of a first watermark training set, usingthe target watermark information as a label of the first watermarktraining set, and using the weight information of the reference neuralnetwork model as an instance of a second watermark training set, andusing the random noise information as a label of the second watermarktraining set; and using the first watermark training set and the secondwatermark training set as a training set, updating the weightinformation of the embedded neural network model according to a modelloss function of the embedded neural network model until the model lossfunction converges.
 4. The method according to claim 1, wherein updatingthe weight information of the target neural network model according tothe target watermark embedded data provided by the embedded neuralnetwork model to obtain the target neural network model embedded withthe target watermark information comprises: inputting first weightinformation of the target neural network model into the embedded neuralnetwork model; obtaining first target watermark embedded data outputtedby the embedded neural network model, the target watermark embedded dataincluding watermark information extracted from the first weightinformation of the target neural network model by the embedded neuralnetwork model; terminating the training of the embedded neural networkmodel if the first target watermark embedded data indicates that thetarget watermark information has been embedded in the first weightinformation, and determining that a target neural network modelcorresponding to the first weight information as the target neuralnetwork model embedded with the target watermark information.
 5. Themethod according to claim 1, wherein updating the weight information ofthe target neural network model according to the target watermarkembedded data provided by the embedded neural network model to obtainthe target neural network model embedded with the target watermarkinformation comprises: inputting first weight information of the targetneural network model into the embedded neural network model; obtainingfirst target watermark embedded data outputted by the embedded neuralnetwork model, the target watermark embedded data including watermarkinformation extracted from the first weight information of the targetneural network model by the embedded neural network model; training theembedded neural network model if the first target watermark embeddeddata indicates that the target watermark information is not completelyembedded in the first weight information to obtain an embedded neuralnetwork model that completes a first training, and providing the firsttarget watermark embedded data to the target neural network model;updating the weight information of the target neural network modelaccording to the first target watermark embedded data to obtain secondweight information of the target neural network model; repeating theinputting, the obtaining and the training using the second weightinformation as the first weight information until the target neuralnetwork model that is completely embedded with the target watermarkinformation and the target watermark information of the embedded neuralnetwork model that is able to be extracted from the weight informationof the target neural network model are obtained.
 6. The method accordingto claim 5, wherein training the embedded neural network model to obtainthe embedded neural network model that completes the first training ifthe first target watermark embedded data indicates that the targetwatermark information is not completely embedded in the target neuralnetwork model, comprises: using the first weight information of thetarget neural network model and the target watermark information as awatermark training set, updating the weight information of the embeddedneural network model according to the watermark training set to obtainthe embedded neural network model that completes the first training. 7.The method according to claim 5, wherein training the embedded neuralnetwork model to obtain the embedded neural network model that completesthe first training if the first target watermark embedded data indicatesthat the target watermark information is not completely embedded in thetarget neural network model, comprises: obtaining random noiseinformation, the random noise information having a same structure as thetarget watermark information; obtaining first weight information of areference neural network model, the reference neural network and thetarget neural network having a same structure, wherein the random noiseinformation is not completely embedded in the first weight informationof the reference neural network model; and using the first weightinformation of the reference neural network model, the random noiseinformation, the first weight information of the target neural networkmodel, and the target watermark information as a watermark training set,and updating the weight information of the embedded neural network modelaccording to the watermark training set to obtain the embedded neuralnetwork model that completes the first training.
 8. The method accordingto claim 1, wherein updating the weight information of the target neuralnetwork model according to the target watermark embedded data providedby the embedded neural network model to obtain the target neural networkmodel embedded with the target watermark information comprises:obtaining a regular term for embedding the watermark informationaccording to the target watermark embedded data; adding the regular termfor embedding the watermark information on a basis of a correspondingmodel loss function when the target neural network model is trainedusing a conventional training set; and updating the weight informationof the target neural network based on the model loss function and theregular term for embedding the watermark information, and obtaining thetarget neural network model embedded with the target watermarkinformation.
 9. The method according to claim 1, wherein the embeddedneural network model is used for obtaining the target watermark embeddeddata according to the weight information of the target neural networkmodel, and the target watermark embedded data is used for representingan embedding degree of embedded watermark information in the targetneural network model.
 10. One or more computer readable media storingexecutable instructions that, when executed by one or more processors,cause the one or more processors to perform operations comprising:obtaining reference weight information of a reference neural networkmodel that is not embedded with watermark information; obtaining targetweight information of a target neural network model that is embeddedwith partial watermark information, the reference neural network modeland the target neural network model having a same structure; and usingthe reference weight information and the target weight information as atraining set to train a detection neural network model, and adjusting amodel training method of the target neural network model according todistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel, and obtaining a target neural network model that satisfies awatermark information hiding condition.
 11. The one or more computerreadable media according to claim 10, wherein using the reference weightinformation and the target weight information as the training set totrain the detection neural network model, and adjusting the modeltraining method of the target neural network model according to thedistinguishability data of the reference weight information and thetarget weight information outputted by the detection neural networkmodel to obtain the target neural network model that satisfies thewatermark information hiding condition, comprise: using the referenceweight information and the first target weight information as thetraining set to train the detection neural network model; obtainingfirst distinguishability data of the reference weight information andthe target weight information outputted by the detection neural networkmodel; determining a target neural network model corresponding to thefirst distinguishability data as the target neural network model thatsatisfies the watermark information hiding condition if the firstdistinguishability data indicates that the reference weight informationand first target weight information is indistinguishable.
 12. The one ormore computer readable media according to claim 10, wherein using thereference weight information and the target weight information as thetraining set to train the detection neural network model, and adjustingthe model training method of the target neural network model accordingto the distinguishability data of the reference weight information andthe target weight information outputted by the detection neural networkmodel to obtain the target neural network model that satisfies thewatermark information hiding condition, comprise: using the referenceweight information and the first target weight information as thetraining set to train the detection neural network model; obtainingfirst distinguishability data of the reference weight information andthe first target weight information outputted by the detection neuralnetwork model; providing the first distinguishability data to the targetneural network model to allow the target neural network model to updatethe weight information according to the first distinguishability dataand obtain second target weight information if the firstdistinguishability data indicates that the reference weight informationis distinguishable from the first target weight information; andrepeating the steps of using, obtaining, and providing with thereference weight information and the second target weight information asthe training set until target distinguishability data satisfying apreset watermark information hiding condition is obtained, and a targetneural network model corresponding to the target distinguishability datais determined as the target neural network model that satisfies thewatermark information hiding condition.
 13. The one or more computerreadable media according to claim 10, wherein using the reference weightinformation and the target weight information as the training set totrain the detection neural network model comprises: sorting thereference weight information, and adding label information that is notembedded with watermark information to the sorted reference weightinformation; sorting the target weight information, and add labelinformation that is embedded with watermark information to the sortedtarget weight information; and using the sorted reference weightinformation and the label information thereof as a first trainingsample, using the sorted target weight information and the labelinformation thereof as a second training sample, training the detectionneural network model according to the first training sample and thesecond training sample, to enable the detection neural network model tobe able to distinguish between the reference weight information and thetarget weight information.
 14. The one or more computer readable mediaaccording to claim 10, wherein using the reference weight informationand the target weight information as the training set to train thedetection neural network model comprises: using the reference weightinformation and the target weight information as the training set, andupdating the weight information of the detection neural network modelaccording to a model loss function of the detection neural networkmodel.
 15. The one or more computer readable media according to claim10, wherein adjusting the model training method of the target neuralnetwork model according to the distinguishability data of the referenceweight information and the target weight information outputted by thedetection neural network model comprises: obtaining a regular term usedfor hiding the watermark information according to the distinguishabilityinformation; adding the regular term used for hiding the watermarkinformation on a basis of a corresponding model loss function when aconventional training set is used to train the target neural networkmodel and a regular term used for embedding the watermark information,and obtaining a target loss function corresponding to the target neuralnetwork model; and updating the weight information of the target neuralnetwork model based on the target loss function.
 16. An apparatuscomprising: one or more processors; and memory storing executableinstructions that, when executed by the one or more processors, causethe one or more processors to perform operations comprising: obtainingweight information of a target neural network model; obtaining targetwatermark information; and using the target watermark information andthe weight information of the target neural network model to train anembedded neural network model, and updating the weight information ofthe target neural network model according to target watermark embeddeddata provided by the embedded neural network model to obtain the targetneural network model embedded with the target watermark information. 17.The apparatus according to claim 16, wherein using the target watermarkinformation and the weight information of the target neural networkmodel to train the embedded neural network model comprises: obtainingweight information of a pre-trained reference neural network modelwithout the watermark information embedded, the reference neural networkmodel and the target neural network having a same structure; obtainingrandom noise information, the random noise information and the targetwatermark information having a same structure; and training the embeddedneural network model according to the weight information of thereference neural network model, the random noise information, the weightinformation of the target neural network model and the target watermarkinformation.
 18. The apparatus according to claim 16, wherein updatingthe weight information of the target neural network model according tothe target watermark embedded data provided by the embedded neuralnetwork model to obtain the target neural network model embedded withthe target watermark information comprises: inputting first weightinformation of the target neural network model into the embedded neuralnetwork model; obtaining first target watermark embedded data outputtedby the embedded neural network model, the target watermark embedded dataincluding watermark information extracted from the first weightinformation of the target neural network model by the embedded neuralnetwork model; terminating the training of the embedded neural networkmodel if the first target watermark embedded data indicates that thetarget watermark information has been embedded in the first weightinformation, and determining that a target neural network modelcorresponding to the first weight information as the target neuralnetwork model embedded with the target watermark information.
 19. Theapparatus according to claim 16, wherein updating the weight informationof the target neural network model according to the target watermarkembedded data provided by the embedded neural network model to obtainthe target neural network model embedded with the target watermarkinformation comprises: obtaining a regular term for embedding thewatermark information according to the target watermark embedded data;adding the regular term for embedding the watermark information on abasis of a corresponding model loss function when the target neuralnetwork model is trained using a conventional training set; and updatingthe weight information of the target neural network based on the modelloss function and the regular term for embedding the watermarkinformation, and obtaining the target neural network model embedded withthe target watermark information.
 20. The apparatus according to claim16, wherein the embedded neural network model is used for obtaining thetarget watermark embedded data according to the weight information ofthe target neural network model, and the target watermark embedded datais used for representing an embedding degree of embedded watermarkinformation in the target neural network model.